Minutes of the meeting of the Audit and Compliance Committee of the Board of Directors of the Cook County 
Health and Hospitals System held Wednesday, April 10, 2013 at the hour of 10:00 A.M., at 1900 West Polk 
Street, in the Second Floor Conference Room, Chicago, Illinois. 

I. Attendance/Call to Order 


Chairman Munoz called the meeting to order. In the absence of a quorum at that time, he appointed Director 
Michael as a substitute Member of the Committee for quorum purposes; therefore, a quorum of members was 
present. 


Present: Chairman Luis Munoz, MD, MPH and Director Edward L. Michael (substitute Committee 

Member) (2) 

Director Hon. Jerry Butler and Gerald Bauman (non-Director Member) 

Absent: Directors Reverend Calvin S. Morris, PhD and Dorene P. Wiese, EdD (2) 

Additional attendees and/or presenters were: 


Cathy Bodnar - System Chief Compliance and 
Privacy Officer 

John Cookinham - System Chief Financial Officer 
Marie Franklin - McKesson Revenue Management 
Solutions 

Tim Heinrich - McGladrey LLP 
Randolph Johnston - System Associate General 
Counsel 

Pat Kitchen - McGladrey LLP 


Natasha Lafayette-Jones - Director of Health 
Information Management 
Ram Raju, MD, MBA, FACS, FACHE - Chief 
Executive Officer 

Elizabeth Reidy - System General Counsel 
Deborah Santana - Secretary to the Board 
Thomas Schroeder - System Director of Internal 
Audit 

John Jay Shannon, MD - Chief of Clinical 
Integration 


II. Public Speakers 

Chairman Munoz asked the Secretary to call upon the registered speakers. 
The Secretary called upon the following registered speaker: 

1. George Blakemore Concerned Citizen 


III. **Report f rom System Corporate Compliance Officer (Attachment # 1) 

A. Activity Report 

B. Update - quarterly coding statistics 

C. Kickoff - Accounting of Disclosures Survey 

Cathy Bodnar, System Corporate Compliance and Privacy Officer, presented her report containing the 
following: quarterly statistics on reactive compliance issues; annual sanction report for employees and 
vendors; and CY12 breach statistics. Information was also provided regarding the following: Board 
education on the final HITECH Omnibus Rule; quarterly monitoring statistics for facility/technical coding 
and professional fee coding; and kick-off of the Accounting of Disclosures Survey. The Committee 
reviewed and discussed the information. 
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III. **Report f rom System Corporate Compliance Officer (continued) 

During the discussion of the information regarding coding, Director Michael referenced page 15 of the 
report; he inquired further regarding the action under which a coder is removed from production. Marie 
Franklin, Coding Manager for McKesson Revenue Management Solutions, responded that when a coder 
scores in the red zone, the coder is removed from production, and the errors are reviewed by Compliance and 
Education. The coder is given thirty additional charts to review; if the coder passes at 90%, the coder is put 
back into production, and under a quality assurance process, 25% of their charts have to be reviewed. If a 
coder fails the remedial batch, the coder is still out of production; another batch is given. Depending on the 
errors, if it is the same error, then management would move toward corrective action. If it is a different 
error, management would provide the education and request additional charts to review. Director Michael 
inquired as to the approximate percentage of coders that are out of production and being retrained in a given 
quarter. Ms. Franklin responded that, overall, perhaps less than 10% are removed from production. 

Natasha Lafayette-Jones, Director of Health Information Management (HIM), provided additional 
information regarding the update on coding. She reviewed some of the internal processes for coding; she 
noted that previously some results were submitted that were their first external audit results. She indicated 
that, with regard to inpatient results, coding accuracy is at 94.1%; the System’s benchmark for coding 
standard is 95%. Management takes the external results and works with the coders to educate; the entire 
group gets the education on what happened, how it happened and how to avoid it. She stated that audit 
results on coding for the Emergency Rooms (ERs) are expected in May and will be brought to this 
Committee and to the Board 1 . 

For the ER audit, she stated that they will segregate out the internal staff and results and the external 
vendors’ results; in the case of ER, facility and professional coding will be reviewed from an external 
perspective. 

Director Velasquez inquired as to the total number of coders on staff at the System, and whether they are all 
certified. Ms. Lafayette-Jones responded that twenty-three coding positions are budgeted for the System; 
twelve positions are filled and eleven are vacant. There are ongoing efforts to recruit and ensure that the 
System reaches the proper staffing model. With regard to junior coders, which are non-certified coders, Ms. 
Lafayette-Jones stated that there are two budgeted positions, both of which are filled. She referenced a 
previous letter of agreement, under which the System had offered education to ramp-up the coders; she 
stated that the junior coders are the two coders that were not able to achieve the level prescribed. Under the 
agreement, the junior coders perform certain types of coding that are not as impactful as more complicated or 
higher-acuity cases. 

Ms. Lafayette-Jones stated that there are efforts to centralize coding. In conjunction with the ICD-10 
project manager, she stated that there is a need to centralize coding to ensure that the System can properly 
educate its coders. 

The current staffing model addresses mainly the acute care coding, which includes inpatient, ERs, same-day 
surgery and observation accounts. This staffing model does not accommodate outpatient, which is 
predominately what McKesson does from a professional fee perspective. Chairman Munoz clarified that the 
additional work load that exists that is not addressed by the current staffing levels is addressed by the System 
bringing on external coding vendors to bring the System to the levels that are needed. Ms. Lafayette-Jones 
responded affirmatively. Chairman Munoz inquired further regarding acute care coding and coding for 
services that fall outside that category. Ms. Lafayette-Jones stated that, with regard to ambulatory services 
and clinics, staff from HIM and Medical Records will also code some of the minor procedure areas, where 
doctors are doing invasive and not basic procedures. 
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III. **Report f rom System Corporate Compliance Officer (continued) 

The Committee held an extensive discussion regarding coding for Trauma services. John Cookinham, 
System Chief Financial Officer, stated that an issue arose in which the System received notice from the State 
that the System had virtually no Trauma activity, which is not the case. This issue appears to be tied to 
revenue codes, rather than to medical coding; it was determined that the Charge Description Master (CDM) 
and the revenue code setup for the services in that area were not set up properly. 

Following the discussion of the matter, Chairman Munoz stated that a report on the issue would be useful, to 
review and get a sense of how the issue evolved and the magnitude - in order to understand whether it was 
an issue involving, for example, information flow, process, or information technology. Mr. Cookinham 
responded affirmatively; he stated that an assessment of the issue will be brought back to the Committee 2 . 

During the review of the information on the Accounting of Disclosures Survey, Ms. Bodnar noted that 
efforts are currently underway to include language in the Conflict of Interest Policy relating to the 
ramifications for not completing the survey within the designated parameters; this language is anticipated to 
be added in time for the roll-out to the entire population by May 2 nd . 


IV. Recommendations, Discussion/Information Item 
A. Update from McGladrey LLP on FY2012 Audit 

The following representatives from McGladrey LLP, provided an update on activities relating to the 
FY2012 Audit activities: Pat Kitchen, Partner; and Tim Heinrichs, Director. The Committee reviewed 
and discussed the information. 

Mr. Kitchen stated that he is pleased to report very good progress on the audit activities; representatives 
from McGladrey continue to receive strong cooperation from System management. In terms of the 
System audit, there are elements of the financial statements that are audited by the Health System audit 
team, and elements that are audited by the County audit team. With respect to the items for which he and 
his colleagues have primary responsibility as the Health System audit team, those areas are substantially 
complete - including cash, inventory, capital assets, accrued vacation and third-party settlements; he 
stated that there are no significant issues to report. 

With respect to the testing of patients accounts receivable, Mr. Kitchen stated that the testing is ongoing; 
they are hoping to conclude this soon, but to date, they have not encountered any issues or red flags/areas 
of concern with that testing. 

The areas being audited by the County audit team include additional cash and investments, self-insurance 
liabilities, debt, pension liabilities, payroll, and various tax revenue. To date, there have been no 
communications from the County audit team with respect to any issues that would have a trickle-down 
effect, in terms of the Health System financial statements. 

Mr. Kitchen stated that the County audit is progressing ahead of schedule; there is a fair amount of work 
yet to be done to complete the audit, in time for the County to file its Comprehensive Annual Financial 
Report (CAFR) by the May 31 deadline. With regard to the completion of the Health System financial 
statements, it was indicated that this should be completed sometime in May. 
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V. Action Items 

A. Minutes of the Audit and Compliance Committee Meeting, January 23, 2013 

Director Michael, seconded by Chairman Munoz, moved to accept the minutes of the 
Audit and Compliance Committee Meeting of January 23, 2013. THE MOTION 
CARRIED UNANIMOUSLY. 

B. Any items listed under Sections IV, V and VI 


VI. Closed Session Items 

A. **Report from System Corporate Compliance Officer 

B. Report from System Director of Internal Audit 

C. Discussion of Personnel Matters 

Director Michael, seconded by Chairman Munoz , moved to recess the regular session 
and convene into closed session, pursuant to the following exceptions to the Illinois Open 
Meetings Act: 5 ILCS 120/2(c)(l), regarding “the appointment, employment, 
compensation, discipline, performance, or dismissal of specific employees of the public 
body or legal counsel for the public body, including hearing testimony on a complaint 
lodged against an employee of the public body or against legal counsel for the public 
body to determine its validity,” and 5 ILCS 120/2(c)(28), regarding “meetings between 
internal or external auditors and governmental audit committees, finance committees, and 
their equivalents, when the discussion involves internal control weaknesses, identification 
of potential fraud risk areas, known or suspected frauds, and fraud interviews conducted 
in accordance with generally accepted auditing standards of the United States of 
America.” THE MOTION CARRIED UNANIMOUSLY. 

Chairman Munoz declared that the closed session was adjourned. The Committee 
reconvened into regular session. 

VII. Adjourn 

As the agenda was exhausted, Chairman Munoz declared the meeting ADJOURNED. 

Respectfully submitted, 

Audit and Compliance Committee of the 

Board of Directors of the 

Cook County Health and Hospitals System 


xxxxxxxxxxxxxxxxxxxxxx 

Luis Munoz, MD, MPH, Chairman 

Attest: 


XXXXXXXXXXXXXXXXXXXXXX 
Deborah Santana, Secretary 
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1 Follow-up: 


2 Follow-up: 


ER coding audit (expected to be completed in May) to be presented at next Audit and Compliance 
Committee Meeting (next regularly scheduled meeting is July 10, 2013). Page 2. 

assessment of the issue involving coding for Trauma Services to be provided. Page 3. 
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Corporate Compliance 

Report 

Cathy Bodnar, MS, RN, CHC 

Chief Compliance & Privacy Officer 
April 10, 2013 



COOK COUNTY HEALTH 
& HOSPITALS SYSTEM 


CC#fHS 


Page 7 of 33 




Meeting Objectives 

■ To file 

- Quarterly statistics on reactive compliance issues; 

- Annual sanction report for employees and vendors; 

- CY12 breach statistics. 

■ To provide Board education on the final HITECH Omnibus Rule. 

■ To report quarterly monitoring statistics for facility/technical coding 
and professional fee coding. 

■ To kick-off the Accounting of Disclosures Survey. 


2 
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1 st Quarter FY 2013 Activity 

78 Reactive Corporate Compliance Issues evened 


Accurate Books 
5% 


Political 

1 % 


Conflict of Interest r- 
5 %_ / 


Fblicy/Regulatory. 
18 % 


False Qaims 
5% 



HIPAA 

48% 




New Category 


r 


Actual Counts 
Privacy (HIPAA) 37 
Polity/Regulatory 14 

Human Resources 5 


Conflict of Interest 4 
False Qaims 4 
Accurate Books 2 


Theft 1 

Political Activity 1 
Other 10 



COOK COUNTY HEALTH 
& HOSPITALS SYSTEM 


CC#fHS 


Page 9 of 33 









Annual Sanction Screening Checks 


John Sterling Associates 

compliance screening of employees, ptiysicians and vendors 

March 12, 2013 

Cathy Bodnar, MS, RN, CHC 
Chief Compliance Officer 
Cook County Health & Hospitals System 
1900 West Polk, Suite 123 Rm 118 
Chicago, IL 60612 

Dear Cathy: 

This is a summary report for our review of Cook County Health & Hospitals 
System employees and vendors which was conducted by our office on February 
28 - March 4, 2013. Based on data we received on February 26, 2013, we 
reviewed 5,970 employees and 1,028 vendors (after removing exact duplicates) 
for possible sanctions which could affect federal or state healthcare funding. 

These individuals and vendors were reviewed by checking for name matches 
against the OIG List of Excluded Individuals/Entities and the System for Award 
Management (SAM) Exclusions list (formerly known as the GSA Excluded Party 
List System) which also includes the U.S. Department of the Treasury Specially 
Designated Nationals (SDN) List. They also were matched against the State of 
Illinois Provider Sanctions list. 

When no match occurs, we assess that individual to be not excluded from federal 
or state healthcare programs. When a possible match does occur, our analysts 
then review each possible match and perform any additional research as 
necessary to resolve each of these matches. After further review, we determined 
that none of these matches were positive. 

These employees and vendors will continue to be screened for any new 
exclusions through our ContinueCheck® monthly rechecking service for the next 
11 months as specified in our contract. Cook County Health & Hospitals System 
also may send us a list of newly-hired employees and newly-engaged vendors 
each month to be included in this monthly rechecking. 

Sincerely, 

Brady Ballman 
Vice President 


The checks are specialized searches to identify 
individuals or entities that have been sanctioned or 
debarred from participation in federally funded 
healthcare programs. 

Sanction screening checks are a requirement for 
recipients of governmental funds. 

CCHHS is prohibited from employing, engaging, 
contracting or agreeing with any individual or entity 
who is sanctioned or excluded from participation in 
a federal program 

No Exclusions Identified for 
Employees or Vendors 
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Breach Reporting 2012 


5 


Total Number of I individuals Affected by 

Breaches of Unsecured Protected Health Information - 348 


“Unsecured” 

■ Protected Health Information (PHI) has been rendered unusable, unreadable, 
or indedpherableto unauthorized individuals. 

- Eectronic—must be encrypted following the requirements set forth within 
the HI PAA Security Rule. 

- Paper, film, or other hard copy media has been shredded or destroyed such 
that the PHI cannot be read or otherwise reconstructed. 
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Questions? 


6 



COOK COUNTY HEALTH 
& HOSPITALS SYSTEM 


CC#fHS 


Page 12 of 33 




HIPAA Omnibus Rule 


Published on January 25, 2013; effective on March 26, 2013. 

Compliance is mandated by September 23, 2013. 

New restrictions and obligations include: 

o Modifications to, and redistribution of, the Notice of Privacy Practices; 

o Expands the definition of a Business Associate — BAs now become directly 
liable for compliance with HIPAA; 

o Increases an individuals’ rights to receive electronic copies of their health 
information; 

o Restricts disclosures to health plans concerning treatment for which the 
individual has paid out of pocket in full; and 

o Prohibits the sale of protected health information without individual 
authorization. 


7 
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Putting Things in Perspective 

March 12,2013 roundtable with DHHS OCR Director Leon Rodriguez, 

■ Compliance is mandatory. 

■ Breaches will continue to happen.. and OCR knows it. 

■ The key to avoiding costly fines and penalties is 

o to have the ability to show OCR what was in place to prevent the breach in 
the first place, 

o to investigate and mitigate the effects of the breach when it occurred, and 

o to review the HI PAA compliance program generally as a result of the breach 
to prevent it from recurring. 


8 
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What’s the Key to Compliance? 

Document Everything — Documentation establishes intent. 

■ “Everything” includes the policies and procedures that were in place at the time 
of the breach that were designed to prevent the breach from occurring in the 
first place. Documentation includes, 

o Verification that workforce members received training on the policies and 
procedures; 

o Evidence of the report and subsequent investigation of the breach; 

o Action taken to mitigate the breach and notifications made to the individuals 
affected by the breach; and, if applicable, 

o Re-evaluation and modification to policies and procedures made as a result 
of the breach and its investigation. 


9 
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Questions? 
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Professional Coding Reviews 

Externally Performed by McKesson 

■ Retrospective reviews are performed quarterly. 

■ All staff performing CCHHS coding are reviewed. 

■ Thirty (30) patient records are selected. 

■ The records reviewed reflect a range of services. 
Performance is scored utilizing the following table: 


Accuracy Levels 

Scoring 

CPT/Modifiers ICD-9-CM 

Remediation 

Minimum Standard 

95% 

95% 


Green 

O 

95-100% 

95-100% 

Feedback on errors 

Yellow 

O 

90 - 94.99% 

90 - 94.99% 

Feedback; if no improvement in 3 quarters - corrective action plan. 

Orange 

o 

85 - 89.99% 

85 - 89.99% 

Corrective action plan with customized training to address 
weaknesses. Corrective actions become more focused with 
increasing levels of monitoring until improvement. 

Red 

• 

Below 85% 

Below85°/c 

Monitoring all coding. Corrective action plan with customized training 
to address weaknesses. If no improvement, removed from production. 
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CCHHS Coding Reviews 

Externally Performed Review of CCHHS Coding Staff 

■ A random sample of 1,203 inpatient records. 

■ The sample assessed 5% of John H. Stroger, Jr. Hospital 
discharge records from FY 2012. 

■ CCHHS overall accuracy rate was 94.1% . 

■ Industry benchmark for coding accuracy is 95%. 

Quality Improvement Activity 

■ External review results used to educate coders to improve 
coding accuracy. 


14 
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Current State 


The mission of the Health Information Management Coding Office is 
to centralize and standardize coding throughout CCHHS. 


Position 

Budgeted 

Riled 

Vacant 

Sr. Coder (Credentialed) 

23 

12 

11 

Jr. Coder 

2 

2 

0 

Total 

25 

14 

11* 


* External coding vendors supplement current 
activity with real-time flexible staffing. 
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Productivity Standards 


CCHHS Coding Standard 

Record Type 

Record Per Hour 

Inpatient 

3 

Observation 

4 

Same Day Surgery 

7 

ED Records 

8 

Outpatient Clinic/ Diagnostics 

25 


Action Plan for Coders Not Achieving Standards 

■ < 85% case-by-case review 

■ 30-60-90 day counseling corrective action plan 

■ Over 90 days without improvement, progressive disciplinary 
action plan. 
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Future State 

Goals 
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Comply with ICD-10-CM and ICD-10-PCS by October 1, 2014 by, 
o Engaging an external project manager; 

o Initiating system-wide education to providers (documentation) 
and coders (anatomy & physiology); and 

o Procure necessary software. 

Centralize coders to one location. 
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Accounting of Disclosures Survey 
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FY 1 3 Work Plan 

Deploy system-wide conflict of interest data collection tool for annual 
attestation and reporting changes throughout the year. 
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Accounting of Disclosures - Workforce 


TECHNOLOGY 


DISCLOSURE 


POLICY 


TRANSPARENCY 
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© 2313 - Cou nty Hea hdi & Hosprta Is System 


Welcome 

Transparency is a critical component to our mission as a public, 
s a re t y -ne: health provide r. VV e are steadfastly dedicated to serve o u r 
community, this includes our professional and business activities. The 
purpose o ; ihis disclosure process is to identify activities that may create 
actual conflicts or have the appearance of conflicts and implement 
safeguards. Gur ultimate goal is to protect the interests and assets of 
Cook County Health and Hospitals System, the people who seek health 
services through our System, the County of Cook, the taxpayers of Cook 
County, and the public at large. 


Login 


Filer ID 
Password 
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Conflict of Interest Policy 


r CCHHS 

1 .ategcrv 

| SYSTEI4-W0E POLICY 

ADMINISTRATIVE OPERATIONS 

-age 

10? 5 

p oscy^- 

CONFLICT OF INTEREST ggi) 

Azprova Cate 

07TMB11 

-cstng Jafe 


PURPOSE 

Tne purpose of tits poScyrs to heip ensure flattie cusnessand professcna actvne softie Coo* County 
-eaiti 5 -csatas System ;CC—S' a»e conduced >eec? a«ua ccnfctscf nicest crtneaxeaencecfany 
conlicts o?mterest and» pictectine imeiests c# CCHHS wtien ms ccmerrplaing entering into a »aisactcn or 
arrangement 

AFFECTED AREAS 

Tins = olic> a^ecs Covered = eecns v.itin ail CCHHS 3* ated cperatng urns mdudmg .ohn - 3«ger Jr. 
Hospital o'Cook County = rcvidentHospital of Cook County Osk =orest -iealti Center Ruti \l Rotistein 
CORE Center Arrtvtaioiy & Cormunty -eabi Neswoifc Ceirrak -edit Services of Cook County and Cook 
County Department of Public Heal* 

DEFINITIONS 

A Ccnficto 1 merest A conficto'mterestmavexistv.hen 

a 3 Covered = eecn orhis.Vier=ersonal ReiaBonsrtps is dong business wti CCHHSorany 
of its operating units.: 

b a Covered 3 erson orhisterPnonal Relanonstnips. has an interest in any issue item, 
matter or wnsacton liat involves CCHHS or its operating units or 4nat is under 
consderation by CCHHS or its cperatng units, 
c a Covered =ersoi orhisVier=eecnai Reiaoonships sna postionto irluence business 
or olier deepens ndudng patent access or care of CCHHS in ways liat could lead or 
appear® lead to die personal gam or advantage of such person hisJier = ersonal 
Relationships or outside enttes 

3 Covered =e«cn All oncers, directors 3oard committee members, advisory councils employees, 
-.-e^ce-s c { jieCCi-HSmedcal ra“orhousesta a itse»ciiers. students and ccnfactorpersonnel 
carrying outlie busness or professional aciviiesofiie CCHHS 

C Como 3usness Having ornegctaang Tiecreatcno'a ccnyactorageement v.hedier veto ally err 
wring ms: nvolves*iecomrTiimentof<ei1ierin3sin^ebansacionoracontnalon o'j-ansactonsj 
S2.500 or more of CCHHS funds or \jnds ccnrolled by CCHHS 

C Gt Any gratuity, discount entertainment, hospitality loan forbearance or ciier tangible or 
intangible item hamg monetary value mdudmg but not limited to cash food anddmk and honorana 
tor speaking engagements related to oratlibutable to a person s status as a Covered = erscn 

E nterest Any legal or equitable economic interest (wfietier or not subject* an encumbrance ora 
ccnducn; activity airaigement orreiaoonsrtp v.hidnscwiedc"ved ebierdreclyorindreedy bya 
Covered Peeon(ar*irougha = ei«cnai Relatcnshipor 3 ason <t nfuencej witi any emty wti v.fuch 
CCHHS has ormayii tie futuie be dong business The term ■'merest indudes, bu: is not limned »1ie 
following examples. 


Adding language to address the 
ramifications of not completing the survey 
within the designated parameters. 
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Closed Session Discussion 
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COOK COUNTY HEALTH HOSPITALS SYSTEM 
CORPORATE COMPLIANCE 

2012 BREACHES OF UNSECURED PROTECTED HEALTH INFORMATION 

Total number of patients impacted: 348 

Total number of breaches, as defined by HIPAA: 15 


Date 

Activity Description 

Activity Resolution 

Individuals 

Affected 

Area 

Involved 

1/24/2012 

Notification of a breach of PHI (to a Department 
of Corrections officer) during examination of a 
detainee at Stroger. 

Investigated and determined a breach occurred. 
Corrective actions included education and follow¬ 
up with involved parties and a breach notification 
letter was sent to the patient. 

1 

Stroger 

2/23/2012 

Notification that a laptop containing unsecured 
(not encrypted) protected health information was 
stolen. 

A breach occurred with the theft of an unsecured 
laptop containing PHI. Patient notifications were 
sent. Hektoen corrective actions included re¬ 
education and notice to adhere to CCHHS laptop 
security standards. Transitioned to Information 
Security Officer. 

257 

Hektoen 

1/31/2012 

Allegation of HIPAA violation when a patient was 
registered in the Emergency Department under 
her twins name in error. Patient was given her 
twin sister's Medication Profile upon discharge 
from the ED. In addition, her twin received a 
portion of the ED bill and the medical records 
were merged together. 

Provided guidance to operational areas. Worked 
closely with Health Information Management, 
Health Information Systems, and ED Registration 
to resolve HIPAA Breach and merged medical 
records. Notification letters were sent. 

2 

Stroger Emergency 
Department 

2/9/2012 

Notification of two cameras stolen from Clinic H. 
The cameras were noticed missing on 2/6/12. 
Each camera contained approximately 20-40 
digital images of patient's breasts without any 
other identifiers. One image included a picture of 
a mammogram with patients name and medical 
record number. 

Reviewed, investigated, provided HIPAA training, 
and met with employee about safeguarding 
patient information, including photographs. 

Breach notification sent to one patient. 

1 

Imaging Services 

4/17/2012 

Allegation of a PHI breach when a patient's 
mother received a Discharge Information Sheet 
for another patient that was seen in the 

Emergency Department the same date. 

Determined breach did occur. Breach notification 
sent to patient that received another patient's 
discharge information sheet. Re-education. 

1 

Provident 

Emergency 

Department 

7/5/2012 

Notification of a patient calling to advise the 
pharmacy that the prescription bag given to him 
contained medication for another patient. 

A breach of patient information was confirmed. 
Patient notification was completed. Action items 
to prevent recurrence were identified by 

Pharmacy. 

1 

Pharmacy 

7/9/2012 

Allegation of PHI breach when a physician e- 
mailed the American Medical Association, 

Patient Safety Consortium, screen shots 
containing protected health information on two 
patients. E-mail was sent from an AOL account 
to an AMA e-mail address, both addresses are 
outside CCHHS firewall. 

Security breach validated. Patients notified. 
Employee remediation pursuant to the 
recommendations of the Hearing Officer. 

2 

Medical Staff 
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COOK COUNTY HEALTH HOSPITALS SYSTEM 
CORPORATE COMPLIANCE 

2012 BREACHES OF UNSECURED PROTECTED HEALTH INFORMATION 


Date 

Activity Description 

Activity Resolution 

Individuals 

Affected 

Area 

Involved 

7/16/2012 

Notification of a story on a local television station 
about the Stroger Hospital's Trauma Unit. 

Re-education to operational area. Patient breach 
notification letters were sent. Policy, 
authorization, and guidance will be routed 
through approval process. 

3 

Public Relations 

8/7/2012 

Notification that a vendor, Discovery Copy 
Services, faxed a medical record to the wrong 
fax number/recipient. 

The erroneous fax was destroyed and the correct 
recipient was sent the materials. A breach 
notification letter was sent to the patient. The 
supervisor discussed the incident with the 
employee and a written record was put in their 
personnel file. 

1 

Discover Copy 
Service 

8/30/2012 

Notification of a patient complaint where the 
patient requested copies of their medical record 
and received, in addition to their own, medical 
records, records of another patient. 

The medical records that did not belong to the 
patient requesting their own record were returned 
to CCHHS. An internal investigation determined it 
to be a clerical error. A letter was sent notifying 
the patient of the breach. 

1 

HIM 

11/19/2012 

Allegation of a pharmacy prescription given to 
the wrong patient. 

Breach of patient information was confirmed. A 
breach notification letter was sent to the patient. 
Corrective action plan put in place with Pharmacy. 

1 

Pharmacy 

11/7/2012 

Notification of PGY1 inadvertently giving PHI 
without permission. 

A (verbal) breach of PHI did occur. A breach 
notification letter was sent to the patient. The 
involved staff was assigned and completed 
additional computer-based training courses on 
privacy and confidentiality. 

1 

Medical Staff 

11/29/2012 

Notified of an article in the Chicago Tribune that 
contained an image (photograph) of patients. 

Confirmed that authorization was not obtained 
and a breach occurred. A breach notification 
letter was sent to all patients that were seen in 
the ED during the time the reporter was there. 
Updated policy, procedures and forms - 
authorization for patient and confidentiality for 
members of the media. 

74 

Public Relations 

12/17/2012 

Notification of use of "HIV POSITIVE" sticker on 
a patient chart. 

Investigation validated that a breach occurred 
related to HIV diagnosis. A breach notification 
letter was sent to the patient. Corrective actions, 
including retraining in process. 

1 

Nursing 

10/29/2012 

Notification that two patients (same last name) 
received each other medications during the 
discharge process. One of the medications was 
a controlled substance. 

Breach of patient information was confirmed. A 
breach notification letter was sent to the patient. 
Corrective action plan put in place with Pharmacy. 

1 

Nursing / Pharmacy 


Total number of patients impacted: 348 

Total number of breaches, as defined by HIPAA: 15 
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Professional Coding Statistics 
Quarter 3 and 4 2012 


MCKESSON 

Empowering Healthcare 




Quarter 3 - 

July - October 2012 


Quarter 4 - 

October - December 2012 

Coder 

CPT/Modifiers 

ICD-9-CM 

Action 

CPT/Modifiers 

ICD-9-CM 

Action 

1 

97.70% 

93.10% 

Feedback; ongoing monitoring 

100.0% 

95.8% 

NA 

2 

83.30% 

99.20% 

Remediation; 100% monitoring until compliant. 

90.0% 

100.0% 

Feedback; ongoing monitoring 

3 

93.00% 

95.00% 

Feedback; ongoing monitoring 

90.0% 

100.0% 

Feedback; ongoing monitoring 

4 

93.00% 

96.00% 

Feedback; ongoing monitoring 

86.7% 

96.7% 

Monitor with corrective action plan. 

5 

93.50% 

99.20% 

Feedback; ongoing monitoring 


95.0% 

Remediation; 100% monitoring until compliant. 

6 

90.00% 

93.30% 

Feedback; ongoing monitoring 

90.0% 

96.0% 

Feedback; ongoing monitoring 

7 

90.40% 

97.30% 

Feedback; ongoing monitoring 

Did Not Code 

8 

100.00% 

98.00% 

Feedback; ongoing monitoring 

Did Not Code 

9 

93.00% 

99.60% 

Feedback; ongoing monitoring 

96.4% 

98.2% 

NA 

10 

100.00% 

100.00% 

NA 

Did Not Code 

11 

93.30% 

99.20% 

Feedback; ongoing monitoring 

Did Not Code 

12 

86.70% 

86.70% 

Feedback; monitor during 4th quarter 

80.0% 

89.0% 

Remediation; 100% monitoring until compliant. 

13 

43.30% 

88.30% 

Coder removed from production 

Did Not Code 

14 

93.30% 

100.00% 

Feedback; ongoing monitoring 

43.3% 

50.8% 

Coder removed from production 

15 

90.00% 

95.00% 

Feedback; ongoing monitoring 

86.7% 

99.2% 

Monitor with corrective action plan. 

16 

90.00% 

100.00% 

Feedback; ongoing monitoring 

77.4% 

90.3% 

Remediation; 100% monitoring until compliant. 

17 

73.00% 

85.00% 

Remediation; 100% monitoring until compliant. 

Did Not Code 

18 

86.70% 

96.70% 

Feedback; monitor during 4th quarter 

Did Not Code 

19 

93.30% 

100.00% 

Feedback; ongoing monitoring 

82.8% 

96.9% 

Remediation; 100% monitoring until compliant. 

20 

96.70% 

96.70% 

Feedback; ongoing monitoring 

Did Not Code 

21 

100.00% 

96.00% 

Feedback; ongoing monitoring 

Did Not Code 

22 

50.00% 

78.70% 

Coder removed from production 

Did Not Code 

23 

64.00% 

91.00% 

Coder removed from production 

Did Not Code 

24 

50.00% 

90.00% 

Coder removed from production 

Did Not Code 

25 

60.00% 

86.00% 

Coder removed from production 

Did Not Code 

26 

96.80% 

98.40% 

Feedback; ongoing monitoring 

96.8% 

98.4% 

NA 

27 

96.70% 

100.00% 

Feedback; ongoing monitoring 

96.7% 

100.0% 

NA 

28 

95.50% 

100.00% 

Feedback; ongoing monitoring 

95.5% 

100.0% 

NA 

29 

Did Not Code 

86.7% 

88.3% 

Monitor with corrective action plan. 

30 

Did Not Code 

90.0% 

92.5% 

Feedback; ongoing monitoring 

31 

Did Not Code 

86.7% 

85.0% 

Monitor with corrective action plan. 

32 

Did Not Code 

84.1% 

100.0% 

Remediation; 100% monitoring until compliant. 

33 

Did Not Code 

95.6% 

99.3% 

NA 

34 

Did Not Code 

95.1% 

95.1% 

NA 

35 

Did Not Code 

90.3% 

88.7% 

Monitor with corrective action plan. 

36 

Did Not Code 

86.7% 

85.8% 

Monitor with corrective action plan. 

37 

Did Not Code 

91.4% 

92.2% 

Feedback; ongoing monitoring 

38 

Did Not Code 

96.6% 

100.0% 

NA 

39 

Did Not Code 

93.8% 

92.2% 

Feedback; ongoing monitoring 

40 

Did Not Code 

94.9% 

95.5% 

Feedback; ongoing monitoring 

41 

Did Not Code 

100.0% 

100.0% 

NA 

42 

Did Not Code 

73.0% 

90.0% 

Remediation; 100% monitoring until compliant. 

43 

Did Not Code 

70.0% 

82.8% 

Remediation; 100% monitoring until compliant. 

44 

Did Not Code 

90.9% 


Feedback; ongoing monitoring 

45 

Did Not Code 

66.0% 

93.0% 

Remediation; 100% monitoring until compliant. 

46 

Did Not Code 

100.0% 

96.0% 

NA 

47 

Did Not Code 

91.4% 

92.9% 

Feedback; ongoing monitoring 

48 

Did Not Code 

93.6% 

97.9% 

Feedback; ongoing monitoring 

49 

Did Not Code 

75.0% 

90.0% 

Remediation; 100% monitoring until compliant. 

50 

Did Not Code 

58.1% 

98.4% 

Remediation; 100% monitoring until compliant. 

51 

Did Not Code 

90.0% 

96.7% 

Feedback; ongoing monitoring 

52 

Did Not Code 

68.8% 

79.7% 

Coder removed from production 

53 

Did Not Code 

73.3% 

85.8% 

Coder removed from production 

54 

Did Not Code 

73.0% 

90.0% 

Remediation; 100% monitoring until compliant. 
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